�Ző����m�]�������Tb���TvY��vB�";�;��J٨�S��H�����+a9�u^tCN�����v��GA��+�{߰���E �ȵ셼�vw�腀��M�����m���^Vmb{J�~FR�qT�\�[�wɟr������t�=t�<.��~�s� $� �Z$b3TD.�ǝ;������ٚ���b�6�4�ԋ����R_7T[��ʼno��j��`�|K��N:�3ץ�K�>�V�跭� <����b����/�Z�1��{����j%��u���}��c��7F�-��a���$��b�Ual๒4p�M��Io���{h�f͔oy����fҊ!YM�ÆLMc��� ��e~��~���~��>4�#ק ! {lVW?��N��]B���rEhq����B8�Y���(U9�Wb�w@�`���#/06t���e�M-���$ԯe�l�3|��&�;��ؕ�1�h�8̈���ZI�){��J�� I�d�1=(�c�ud�aNH��Gs�J�hㆪO|��@��KR���nٰ��e �uR9�-��Z�CP�A��d�N|@R1��������`T������x��T�NZp笌la��P�zx���Y`(}��yb�06��y+���([)7Ƿ�����:�O�]��1�`ϭ����2 "��F�cRW�̴������K>���3���=�`%���J��$���͖ hAJS&yFpx/��]����3b�1a��@v���&��S�����*D�M�C�I �YB~^�t�Ŵ���5sW'A�j7,���/]�a3FGqG����׀����]haY�Utg��m*��T��n�� �Az'��`��L�'3_:ů�L�Fn����ŀ��s�O�A��:[%�vŻ0Q�O��Ư-(&��T!d#��ox4��rӬkX}������&ն�^��>P���p֊"�&F�I�b��6#|F�m`pI���)A�e����/�J4����L߾�4���W����hi���N�(��s9�X����}���+�6x��y�[`�;��ؑ��XvS� �T�!�8�'k]ΒWĵ�� j��7�8T�����9`;��� p�?=z�\��Du��d��������t� ��v�lns�>k���>n£��i8���(�qS���Ί�ߜ��v`�5�h��ӔY���'��P��W�ٻ��~�oj�|�L*�����oVI �&��"���+^�ڑHE�q�R�cfXS�"&���f�K�yz�Q�c����tW����9�Uf;� ����Y1.dW>ưnΰ�����M**5�Pw�����>ڼܺlGX1����c����&�q:��"��&�����9�$F���R�V?����1wϥƙ��_+�N����*�C���g-��;ݾ?��vޜ�%��ջ�J������+g�{Q�T��v4pa� �.-�ȫ�N��מ9��t:_97'.��#�{����j5"Q��@ �H�v-�L�hKS��x+���<#y�M%�蝈� ���yr��BNѵ�ȼ�-?�º/I0���0Ew]0|PC^(��c�n���@�-�E���C�c� �Vf�5�Qh�M�ټ ��5�`�������O":����z�1C����F)Z�w)�����t&%[�ы��mn����D�A�fk?�!u��_��?�(�7-n��,�jos~�f��U���K�H��Ț�Þ�}��Vcr,�@��e���l��k`Y�����l�j��R������ᱰ�Q��b�a��3�{X��v����:S��+=D� VA���%�&�mʒD�#��|o�ݪ�)Ϟ�*l���Gގ�q��MDh��5�aSy�D��!�{0H�ނ�qΖ F��8��P<�̬Vw�b��s�wu�%�n��{��`Ƨi�ᖗ���p�%I[���|m.��p��w���Ap}�;���v��)��,��Y���/�}6Qx� :��:��y�x�z]��O+Ǟ���f������wX�7߭u�@)�5��N�8Q���2��=K����f4������7dN�������$;�T}�H}��wU�"v�j����%�?x�}^ �p�C5S��-S;���B��c�5���Oq ��C*~���]�!��dƀ�H�Lbk 3���-M�sf�����3@�gTȃ��� UG�����G��9NyF�>\?!NuP�1��)P()��Ƥ���!��U�?[��ސ$d1�o_�L�\c��Ԅje��=���J�;b�: ���!�e�u���C¾�H�Q��I�[Ժ�?��邤Y°@ �zh&iz>�f���bX��fe�G�q�`���s�{�FZZ$ض��X�C��Mi���6ݞ"��K'#_9д������=Y`�y`Q��7Gz8������s{�o~�*�Utځ���r��s+ӳ��"% D��\d:�|������@,ۣ�^��r�Y��xnv�v����'X��nG����2Z��7�߭e��oz���fw�FB�e�e.<��zK���s�Z���0X�//�!A0�I�N�_|%�S#�[@Ii/�h�Z*���R�������|t����|����^��;��e8Q�M��F�~A_��ݏ��Z61 �G�~G�߿��ҤN�/`ـ���]Cǎ)�̎��o>�Qo;Ϫڕ ����!W�{�#��Q�ҀrWCv�G����]�,/�${2�yY���ɆpC�yh��jb�vΊ���`��L1���!≨�0�Hj�w���AL�4�0�W1d3F;d���z��v�i�jz�� ge�-�Z8W�����! ��iٖ�OM/����#�F�B��sN�$57P�ʾZ����KP��c�y�C�cw�F�SzW�2�.�9q7�>f��4%�I@SV� �÷c����,��1%� �}\����"��Uk���'�7{|����l�@_n����UV�C<���;�}��"v�] z�x�A]�ާ�9��`�K�$�T ǔMP���&�aU��zY'�D���0�c��C�k 6�yП"S�[��T;�怢 VH6x�P�(�wo+�GF�_�����--V��4H���;6�N��͎�/��
Behavioral task
behavioral1
Sample
d5d1a781e28083193e2dff901fdc90b9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5d1a781e28083193e2dff901fdc90b9_JaffaCakes118
-
Size
184KB
-
MD5
d5d1a781e28083193e2dff901fdc90b9
-
SHA1
b86185706350dc440f8d0ccc698c3db4291cd3ad
-
SHA256
9859b3997129be6adecfbaa211beb06f1b1fe5572742b3b77451d8ede7d77324
-
SHA512
9451d0eb68fb871b9d2e06215b714936bec2d30cbeb994b1063051d98552a091f40e6b98c2a8599cf42da73b521b03ee707b0eeac77016f3825536641bf654db
-
SSDEEP
3072:d8Lt27+m2h9nZsLOgTftFy0EbD59rMEPBcJFRbsYVKPfx0/v62L:KLt3m2LS9T/GbBaFRbsAW0/vHL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5d1a781e28083193e2dff901fdc90b9_JaffaCakes118
Files
-
d5d1a781e28083193e2dff901fdc90b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
e7cf9dcb0cd116edd2853bfe4dd31180
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLsetFixstr
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 172KB - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE